Multiple vulnerabilities have been reported in various VMware products, which can be exploited by malicious, local users to gain escalated privileges or cause a DoS (Denial of Service) or by malicious people to compromise a vulnerable system.

1) An unspecified error can be exploited by a user with administrative privileges in the guest system to cause a memory corruption on a certain host process.

Successful exploitation may allow execution of arbitrary code on the host system.

2) An unspecified error can be exploited within the guest system to cause a host process to crash.

The vulnerabilities affect VMWare ESX 3.0.1, 3.0.0, 2.5.4, 2.5.3, 2.1.3, and 2.0.2, VMWare Workstation 6.0.0 and 5.5.4, VMWare Player 2.0.0 and 1.0.4, VMWare Server 1.0.3, and VMWare ACE 2.0.0 and 1.0.3.

3) An integer underflow error in the DHCP server can be exploited to cause a stack-based buffer overflow via a specially crafted DHCP packet.

4) An integer overflow error in the DHCP server can be exploited to cause a stack-based buffer overflow via a specially crafted DHCP packet.

5) Improper handling of malformed DHCP packets can be exploited to execute arbitrary code via a specially crafted DHCP packet.

Successful exploitation of the vulnerabilities allow execution of arbitrary code.

6) Improper starting of registered services can be exploited to gain escalated privileges.

The vulnerabilities affect VMWare Workstation 6.0.0 and 5.5.4, VMWare Player 2.0.0 and 1.0.4, VMWare Server 1.0.3, and VMWare ACE 2.0.0 and 1.0.3.

Solution
Update to the latest version or apply patches.
Further details available to Secunia VIM customers

Provided and/or discovered by
The vendor credits:
1-2) Rafal Wojtczvk, McAfee
3-5) Neel Mehta and Ryan Smith, IBM ISS X-Force
6) Foundstone

Changelog
Further details available to Secunia VIM customers

Original Advisory
VMWare:
http://www.vmware.com/support/ws6/doc/releasenotes_ws6.html#601
http://www.vmware.com/support/ws55/doc/releasenotes_ws55.html#555
http://www.vmware.com/support/server/doc/releasenotes_server.html#resolved
http://www.vmware.com/support/ace2/doc/releasenotes_ace2.html#new_201
http://www.vmware.com/support/player/doc/releasenotes_player.html#105
http://www.vmware.com/support/player2/doc/releasenotes_player2.html#201
http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html

IBM ISS X-Force:
http://www.iss.net/threats/275.html
http://xforce.iss.net/xforce/xfdb/33103
http://xforce.iss.net/xforce/xfdb/33102
http://xforce.iss.net/xforce/xfdb/33101

Deep Links
Links available to Secunia VIM customers